Vulnerability · Published May 14, 2022 · Assigned by @huntrdev
CVE-2022-1379URL Restriction Bypass in plantuml/plantuml
High 7.2
In plain English
A high-severity server-side request forgery in plantuml/plantuml from plantuml. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)1.6%top 23.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| plantuml | plantuml/plantuml | unspecified – before V1.2022.5 |
Weakness: CWE-918 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
References
- https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a x_refsource_CONFIRM
- https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083 x_refsource_MISC
- FEDORA-2022-e6c09a89eb vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-fda9f1f7bd vendor-advisory, x_refsource_FEDORA